Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm in doubt about how to scan my Linux system with Clamav: do I just scan the places where users can upload files (homedirs, their webroots) or do I scan the whole system?

The various sites I've read vary in opinion, some say you needn't scan the Linux-only parts, some say to not scan at all. The latter I've already discarded as I think it sensible to at least scan webroots for hosted viruses, but scanning the whole system is still something I am in doubt about.

share|improve this question

3 Answers 3

up vote 1 down vote accepted

ClamAV doesn't do well in many tests of antivirus (percentage detected) - better to find a commercial antivirus with Linux version that has good ratings on independent tests. See http://www.av-comparatives.org/en/comparativesreviews - however http://www.shadowserver.org/wiki/pmwiki.php/Stats/VirusYearlyStats shows it's in about the middle of the pack.

ClamAV won't find the most common sort of malware present on Linux web servers, namely web-based malware that compromises the website, rather than the web server itself. You can use LMD to find such malware typically: http://www.rfxn.com/projects/linux-malware-detect/

Since viruses affecting the Linux OS are rare to non-existent I would focus antivirus scans (ClamAV or other) on areas where Mac/Windows files could be uploaded, and run LMD over all web roots.

You might want to also set rkhunter to scan the whole system for known rootkits. (chkrootkit project appears to be dormant since 2009)

share|improve this answer
    
thanks for this insightful answer. I didn't know about LMD, I do already use rkhunter. Chkrootkit seems to be dead in the water(?) –  datadevil Mar 20 '12 at 15:27
    
good point about chkrootkit - updated answer. Last release was 2009 though site still up at chkrootkit.org - however the www.chkrootkit.org link is the first google result and doesn't work at all. –  RichVel Apr 15 '12 at 7:04

I'd scan my whole system, you never know what you contracted. Sure it will take a bit longer, but do you really want to take that chance?

share|improve this answer

What would it hurt to scan the whole system? Your system installation is probably very tiny compared to what you have in user home directories, at least if you have any serious amounts of users. Are you scared of performance issues? Why the doubt?

share|improve this answer
    
performance mostly, and just wanting to think of a good default for new server installs –  datadevil Mar 20 '12 at 9:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.